Access Control List Bug in Varnish HTTP Cache Affects Version Prior to 3.0.4
CVE-2013-4090

7.5HIGH

Key Information:

Vendor: Varnish Cache Project
Status: Varnish Cache
Vendor: CVE Published:; 12 February 2020

🔔 Create Varnish Cache Project Vulnerability Alert

What is CVE-2013-4090?

An ACL bug in Varnish HTTP Cache versions prior to 3.0.4 allows unauthorized access to cached content. This flaw can potentially expose sensitive information, as it fails to properly enforce access control policies. As a result, attackers could exploit this vulnerability to gain unauthorized visibility into cached data, undermining the security measures intended to protect this information. Users of affected versions are strongly advised to update to the latest version to mitigate risks associated with this vulnerability.

References

https://www.varnish-cache.org/lists/pipermail/varnish-ann...

x_refsource_MISC

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Feb 12, 2020
Vulnerability Reserved
Jun 10, 2013

CVE-2013-4090 Data

JSON